انتقل إلى المحتوى الرئيسي
جميع السياسات

Ethics and Governance

Supplier and Third-Party Policy

Main service providers, shared data and data locations; no single supplier list yet.

Version
1.0
Effective
7 November 2026
Owner
Board of Directors, International Social Benefit Association
Review
At least once a year and whenever a new service provider is added
Category
Ethics and Governance
Last updated
7 November 2026

النسختان الملزمتان هما التركية والإنجليزية، وإذا اختلفتا يُعتمد النص التركي. تُعرض نصوص السياسات باللغة الإنجليزية.

لغة النص

1. Purpose

To explain how we choose the companies that provide services to hangel, what data we share with them and how we monitor these relationships.

2. Scope

All suppliers of goods and services to the Association; in particular cloud, e-mail, messaging, AI, error monitoring, meeting and affiliate service providers that process personal data on hangel's behalf.

3. Principles

  1. Only the data needed. A supplier receives only the data needed for the service.
  2. Data protection safeguards. For suppliers that process personal data, the data protection terms (data processing agreement, region, sub-processors) are reviewed.
  3. Shared responsibility. A supplier's security certifications do not transfer to hangel; hangel is responsible for its own configuration.
  4. Ethical expectations. Suppliers are expected to behave in a way consistent with our position against bribery, forced labour and discrimination.
  5. Openness. We name our main service providers and data locations in public texts.

4. Roles and responsibilities

  • Board of Directors: approves significant supplier contracts.
  • Technical lead: manages the technical and security settings of service providers.
  • Super-admins: manage provider keys handled in the panel; keys are never shown in full on screen.

5. How it works at hangel today

Main types of service providers and examples:

TypeExampleNote
Cloud infrastructureGoogle Cloud / FirebaseDatabase in Europe (eur3), application server in the Netherlands, file storage in the United States
AIGoogle Gemini, Anthropic ClaudeAI Ethics Policy
Error monitoringSentryEuropean (Germany) data region; no names, e-mail addresses or user IDs sent
Visitor analyticsMicrosoft ClarityOnly with analytics cookie consent; form fields are masked
Bot protectionGoogle reCAPTCHAOn registration, contact and survey forms
E-mail, SMS, WhatsAppE-mail delivery services, SMS providers, Meta WhatsAppNotifications and verification codes
MeetingsLiveKit-based Oda server, Google Meet and YouTube integrationsOrganisations set up the connection themselves
AffiliateAffiliate networks and partner shopsDonation and Affiliate Transparency Policy
Mobile platformsApple and Google (notifications, wallet, sign-in)
  • Some secrets are kept in Secret Manager; AI provider keys are kept in records that only the server can read.
  • A software component list (SBOM) is generated and published with every release.

6. Not yet in place and our goals

  • A single, up-to-date supplier list showing all suppliers, the data types they process, their regions and contract status (ISMS-09) has not yet been prepared.
  • The existence of a data processing agreement and the basis for international transfer have not been checked supplier by supplier; the assessment under Article 9 of the KVKK is under review by our lawyer.
  • No annual security and ethics assessment of suppliers is carried out.
  • Supplier contracts contain no ethics or human rights clause.

7. How to raise a concern

Concerns or security issues about a supplier: info@hangel.org. Misconduct: kvkk@hangel.org (subject "Whistleblowing — Confidential").

8. Review

At least once a year and whenever a service provider is added or removed.

9. Related documents

Information Security Policy · Privacy Policy · Existing "Data Transfer and Hosting Statement", "Procurement Policy" and "Third-Party Oversight and Ethical Performance Statement"

نصوص ذات صلة

صفحات ذات صلة

جميع السياسات